amazonsupport.gb-webhelp.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 84.234.96.149, located in Romania and belongs to THCPROJECTS, RO. The main domain is amazonsupport.gb-webhelp.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on September 4th 2021. Valid for: 3 months.

This is the only time amazonsupport.gb-webhelp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 3	84.234.96.149 84.234.96.149	51177 (THCPROJECTS) (THCPROJECTS)
4	2600:9000:224... 2600:9000:2240:c600:1d:d7f6:39cf:a761	16509 (AMAZON-02) (AMAZON-02)
5	2

3 84.234.96.149 (Romania) 2 redirects

ASN51177 (THCPROJECTS, RO)
PTR: s7-96-234.thcservers.com

www.amazonsupport.gb-webhelp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
amazonsupport.gb-webhelp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2240:c600:1d:d7f6:39cf:a761 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ssl-images-amazon.com images-na.ssl-images-amazon.com	132 KB
3	gb-webhelp.com 2 redirects www.amazonsupport.gb-webhelp.com amazonsupport.gb-webhelp.com	10 KB
5	2

	Domain	Requested by
4	images-na.ssl-images-amazon.com	amazonsupport.gb-webhelp.com images-na.ssl-images-amazon.com
2	amazonsupport.gb-webhelp.com	1 redirects
1	www.amazonsupport.gb-webhelp.com	1 redirects
5	3

This site contains no links.

Subject Issuer	Validity	Valid
amazonsupport.gb-webhelp.com ZeroSSL RSA Domain Secure Site CA	`2021-09-04` - `2021-12-03`	3 months	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-03-23` - `2022-03-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazonsupport.gb-webhelp.com/verification/
Frame ID: 473DEFF7277315564B2486F294086EB8
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Page URL History Show full URLs

http://www.amazonsupport.gb-webhelp.com/ HTTP 301
https://amazonsupport.gb-webhelp.com/verification HTTP 301
https://amazonsupport.gb-webhelp.com/verification/ Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

141 kB
Transfer

441 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.amazonsupport.gb-webhelp.com/ HTTP 301
https://amazonsupport.gb-webhelp.com/verification HTTP 301
https://amazonsupport.gb-webhelp.com/verification/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3-Q050	200	Primary Request / Show response amazonsupport.gb-webhelp.com/verification/ Redirect Chain http://www.amazonsupport.gb-webhelp.com/ https://amazonsupport.gb-webhelp.com/verification https://amazonsupport.gb-webhelp.com/verification/	25 KB 9 KB	106ms 53ms	Document text/html	84.234.96.149 THCPROJECTS
General Check archive.org Show headers Download Go to Full URL https://amazonsupport.gb-webhelp.com/verification/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 84.234.96.149 , Romania, ASN51177 (THCPROJECTS, RO), Reverse DNS s7-96-234.thcservers.com Software LiteSpeed / Resource Hash `f7e6c327629e1a10a1c081ed810358f5a04ad55a4436a73ff0571e4764968eeb` Request headers :method GET :authority amazonsupport.gb-webhelp.com :scheme https :path /verification/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers set-cookie PHPSESSID=6ad14bb7669c1be00a61d180cb25eb92; path=/; secure expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache content-type text/html; charset=UTF-8 content-length 9352 content-encoding br vary Accept-Encoding date Sat, 04 Sep 2021 18:46:20 GMT server LiteSpeed Redirect headers content-type text/html content-length 706 date Sat, 04 Sep 2021 18:46:20 GMT server LiteSpeed location https://amazonsupport.gb-webhelp.com/verification/ alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-24=":443"; ma=2592000, h3-25=":443"; ma=2592000
GET H2	200	AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	113 KB 19 KB	8ms 7ms	Stylesheet text/css	2600:9000:2240:c600:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css Requested by Host: amazonsupport.gb-webhelp.com URL: https://amazonsupport.gb-webhelp.com/verification/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2240:c600:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `02f9e4f6271092d6fa6ac1854427e1ab744a58b9b7f58a02afe29f81a914baec` Request headers Referer https://amazonsupport.gb-webhelp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Tue, 23 Mar 2021 06:02:09 GMT content-encoding gzip age 14301852 edge-cache-tag x-cache-192,/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4 x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-192 /images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4 last-modified Fri, 05 Feb 2016 03:02:58 GMT server Server content-type text/css; charset=utf-8 via 1.1 857b0dca772798c338c78a1be69c955d.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id a3ee671a-2401-462b-9382-9b9d4383aee3 x-amz-cf-pop FRA60-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id q91tKpHOaxB6Y-OvpFPRCTKmwAfdnBN78AanIp6bPCNjXtUN4u7wug== expires Mon, 18 Mar 2041 06:02:09 GMT
GET H2	200	AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	256 KB 80 KB	21ms 7ms	Script application/x-javascript	2600:9000:2240:c600:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js Requested by Host: amazonsupport.gb-webhelp.com URL: https://amazonsupport.gb-webhelp.com/verification/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2240:c600:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `16aecd5524ada4c6ff3326d33ac9e3af9cfa3c1ec117de4e0f19966bf0af4b1a` Request headers Origin https://amazonsupport.gb-webhelp.com Referer https://amazonsupport.gb-webhelp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 11 Jun 2021 23:56:15 GMT content-encoding gzip age 7325406 edge-cache-tag x-cache-991,/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736 x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-991 /images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736 last-modified Wed, 03 Feb 2016 20:16:14 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 0877da90-eb1c-4ae7-9e84-3bdc2852ada1 x-amz-cf-pop FRA60-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id 0S0f_FkDinh4Md6CaluETtgNX8Vt08tGaXT7JRPw7vvYFCd7uF-CZg== expires Mon, 03 Jun 2041 16:54:05 GMT
GET H2	200	AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	24 KB 8 KB	29ms 15ms	Script application/x-javascript	2600:9000:2240:c600:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js Requested by Host: amazonsupport.gb-webhelp.com URL: https://amazonsupport.gb-webhelp.com/verification/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2240:c600:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `7d7566ca5de5262510d5409e340be9ab6f1e5f9730bda17a2ca1538442c01928` Request headers Origin https://amazonsupport.gb-webhelp.com Referer https://amazonsupport.gb-webhelp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sat, 14 Aug 2021 16:43:46 GMT content-encoding gzip age 1821755 edge-cache-tag x-cache-376,/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f x-nginx-cache-status MISS x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-376 /images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f last-modified Sat, 26 Mar 2016 01:05:52 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 76a47333-7a79-42ac-a973-6e57cedf039c x-amz-cf-pop FRA60-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id yDURPWVepOlHoK-k5lTTgGNlz9GZBnjBD2rrJhmJJGdOspr48-PmKA== expires Fri, 09 Aug 2041 16:43:46 GMT
GET H2	200	AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	24 KB 25 KB	8ms 8ms	Image image/png	2600:9000:2240:c600:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css#AUIClients/AmazonUI.fr.rendering_engine-not-trident.secure.min Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2240:c600:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `84ea8004fab8c9fd2911393bcc36020df3ba4f83e2762425fbe0e79653a8b3f2` Request headers Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 05 Feb 2021 19:42:21 GMT via 1.1 857b0dca772798c338c78a1be69c955d.cloudfront.net (CloudFront) age 18564012 edge-cache-tag x-cache-550,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d x-cache Hit from cloudfront content-length 24594 surrogate-key x-cache-550 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d last-modified Tue, 20 Oct 2015 02:26:17 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id c899bdee-9d3b-4256-9f5c-654bfb9d1b2c x-amz-cf-pop FRA60-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id ZCmR6KyreDPgY10vg92-GwizR7O6nzSEgZTjh43hCvQOPigTSxwwDw== expires Sun, 27 Jan 2041 22:06:08 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazonsupport.gb-webhelp.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6ad14bb7669c1be00a61d180cb25eb92

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazonsupport.gb-webhelp.com
images-na.ssl-images-amazon.com
www.amazonsupport.gb-webhelp.com
2600:9000:2240:c600:1d:d7f6:39cf:a761
84.234.96.149
02f9e4f6271092d6fa6ac1854427e1ab744a58b9b7f58a02afe29f81a914baec
16aecd5524ada4c6ff3326d33ac9e3af9cfa3c1ec117de4e0f19966bf0af4b1a
7d7566ca5de5262510d5409e340be9ab6f1e5f9730bda17a2ca1538442c01928
84ea8004fab8c9fd2911393bcc36020df3ba4f83e2762425fbe0e79653a8b3f2
f7e6c327629e1a10a1c081ed810358f5a04ad55a4436a73ff0571e4764968eeb

amazonsupport.gb-webhelp.com Open in urlscan Pro 84.234.96.149 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

141 kBTransfer

441 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

1 Cookies

Indicators

amazonsupport.gb-webhelp.com Open in urlscan Pro
84.234.96.149 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

141 kB
Transfer

441 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!